Terraform.

Terraform is HashiCorp's declarative Infrastructure as Code (IaC) tool. You describe the end state in configuration files, and Terraform works out the steps, where imperative tools make you script each step. Since version 1.6 its license is the Business Source License, which is source-available, not open source.

Compared with other IaC tools, three things stand out:

• It is provider-agnostic. One workflow manages AWS, Azure, Google Cloud and many other services, while CloudFormation is AWS's own tool for AWS resources.
• A state file maps the configuration to the real resources.
• terraform plan previews each change before terraform apply makes it.

You write configuration, initialize the directory with terraform init, then preview and make each change with terraform plan and terraform apply.

1. Write configuration in .tf files that describe the resources you want.
2. Initialize the directory with terraform init, which downloads the providers and modules it needs.
3. Plan with terraform plan, which compares the configuration with the current state and previews the changes.
4. Apply with terraform apply, which creates, updates or destroys resources to match and records the result in state.

Every later change goes through write, plan and apply again. When an environment is no longer needed, terraform destroy removes everything the configuration manages.

terraform init
terraform plan
terraform apply
terraform destroy  # when cleanup is needed

Providers are plugins that let Terraform work with cloud platforms, SaaS providers and other APIs. Each one defines the resource types and data sources you can use, such as aws_instance.

You configure a provider in two blocks. required_providers declares its source address and a version constraint, and terraform init downloads a matching release. The provider block sets options such as the region.

terraform {
  required_providers {
    aws = {
      source  = "hashicorp/aws"
      version = "~> 5.0"
    }
  }
}

provider "aws" {
  region = "us-west-2"
}

Here ~> 5.0 accepts any 5.x release but never 6.0, so a major upgrade cannot arrive by surprise.

A resource is an object Terraform creates, updates and destroys, and its block describes the desired state of that object. A data source only reads information about something that already exists, and never changes it.

Terraform records each resource in state and owns its whole lifecycle. A data source fetches attributes of an object managed elsewhere, or of an external system. You reference it with the data. prefix, as in data.aws_vpc.default.id.

# Resource - creates new EC2 instance
resource "aws_instance" "web" {
  ami           = "ami-12345678"
  instance_type = "t2.micro"
}

# Data source - fetches existing VPC info
data "aws_vpc" "default" {
  default = true
}

Use a resource for infrastructure this configuration should own. Use a data source when it only needs to look something up, such as the default VPC.